There’s a lot going wrong here, but I don’t mean to blame you specifically. Many of the things that make PHP popular, like it’s long history of support on shared hosting providers and how it’s easy to pick up and get going, are also a huge liability: There’s a lot of dangerously old advice out there, and many tutorials are written by people who really do not know what they’re doing. It is a minefield to navigate, especially if you have never done this sort of thing before.
To side-step all of that you can use a development framework where modern PHP coding practices are on display. The best of these organize the code so that there’s a very minimal amount of raw PHP code in the web root, that is the files that are accessible to the public. Many have just one stub, index.php, which everything is routed through. All the other URLs are, in essence, faked out by routing. There’s no literal file to back them up. This is good because it decouples URLs from links to files and instead turns them into abstract resources.
This is how they manage to keep the application code from leaking out: The code put in the public web root is extremely minimal by design. If your server ends up misconfigured for whatever reason and starts spewing out .php files as raw source there’s no harm, all they get is the boilerplate index.php stub that comes with every application of that type. No credentials, no database configuration information, nothing.
Laravel is a good example to study, it even includes an authentication system so there’s no need to code your own. The database config in this case is just a regular PHP file, but other systems use JSON, YAML, or an old-fashioned INI file.
The biggest problem here is the use of string interpolation to compose your queries. If you make a mistake, forget to escape something, you’ll open up a huge SQL injection hole. From there it’s possible that someone can inject arbitrary SQL code into your site, and with that, grab the whole database or worse, maybe download the application’s code as well if the database is running on the same physical machine.
At the absolute least use something like PDO. Even better, use an ORM that encapsulates your database operations in a much easier to use object-oriented wrapper. Doctrine, Propel and Eloquent are all good examples of these.
The most important thing to note is that making a secure site in 2017 is not easy if you’re building from the ground up using just core PHP. There’s so many things to consider: CSRF, XSS, SQL injection, password hashing, email verification, password guess rate limiting, caching, database migrations, and a host of other things. Fully understanding and implementing a coherent strategy for any one of those might months. It’s beyond the scope of a single developer to realistically achieve, though I do encourage you to at least understand them on an academic level, the theory and implications of each.
PHP is lucky it has a lot of very good, well supported frameworks that come in a variety of forms. Find one you really like, learn it well, and use that for your projects. You’ll be able to focus on writing code that makes your application unique instead of wasting a good chunk of that time badly re-implementing the wheel.
4
solved How to properly take input from user to HTML form?